CVE-2026-2625

Name	CVE-2026-2625
Description	A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1128418

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-rpm-sequoia (PTS)	trixie	1.8.0-2	vulnerable
	forky, sid	1.10.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-rpm-sequoia	source	(unstable)	1.10.2-1			1128418

Notes

[trixie] - rust-rpm-sequoia <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2440357
https://github.com/rpm-software-management/rpm-sequoia/commit/fa3c60094fa853ede6b4862e936f246412d700de (v1.10.2)